Skip to content

Fix: Support Hexadecimal HTML Entities in HtmlEntityMapper - #1884

Open
srvcti wants to merge 2 commits into
Zimbra:developfrom
srvcti:fix-hexadecimal-html-entities
Open

Fix: Support Hexadecimal HTML Entities in HtmlEntityMapper#1884
srvcti wants to merge 2 commits into
Zimbra:developfrom
srvcti:fix-hexadecimal-html-entities

Conversation

@srvcti

@srvcti srvcti commented Aug 24, 2026

Copy link
Copy Markdown

This PR fixes a long-standing known limitation (\TODO FIXME) in \HtmlEntityMapper.java\ where the parsing engine failed to recognize or map Hexadecimal HTML entities (e.g. A).

By introducing a non-capturing group to the Regex pattern and natively decoding the base-16 matcher group, Zimbra can now successfully identify, map, and defang hexadecimal unicode entities identically to decimal entities.

This dramatically improves webmail rendering fidelity and strengthens the anti-XSS defang engine against hexadecimal obfuscation bypasses.

@CLAassistant

Copy link
Copy Markdown

CLA assistant check
Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.


srvcti seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
You have signed the CLA already but the status is still pending? Let us recheck it.

@srvcti
srvcti force-pushed the fix-hexadecimal-html-entities branch from abdb618 to b41f4b3 Compare August 24, 2026 20:07
@srvcti
srvcti force-pushed the fix-hexadecimal-html-entities branch from b41f4b3 to 3cedfe2 Compare August 24, 2026 20:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants